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(54) Shopping system 

(57) A shopping system for safely communicating 
shopping data among information processors has first 
to third information processors (1, 2, 3). The first infor- 
mation processor (1 ) has a first storage unit (1 3) for stor- 
ing an address to which ordering data is to be transmit- 
ted and a second storage unit (1 1 ) for storing electronic 
money and transmits ordering data in accordance with 
an order. The second information processor (2) re- 
sponds to the ordering data to issue a payment address 
and invoice data (51 ) obtained by digitally signing an in- 
voice. The first information processor responds to the 
invoice data to transmit an amount of electronic mone y 
corresponding to the order to the payment address/The 
third infor mation processor (3) responds to reception of 
the electronic money to issue a receipT(53) digitally 
signed by a private ke y. The first information processor 
transmits the digitally signed receipt received from the 
third information processor to the second information 
processor. The first information processor can digitally 
sign the invoice data digitally signed by the second in- 
formation processorto transmit it to the third information 
processor. The third infor m ation processor checks tw o 
signatur sonth received invoice data of one is signe d 
by the s cond info£m atiorLDrocesson.an d_thejpther „,is 
signed b y the_first_information_proc sso r. The first infor- 
mation processor transmits a request for r p aying th 
electronic mon y transmitted to th third informatio n 
processor in accordance with the order to th second 



information processo r, t he second information proce s- 
sor transmits repayment permit data including data f or 
specifying a repaying apparatus, an amount of r e fund 
and data for specify in g a refund receiving apparatus af - 
ter digitally signingjh e repayment permit jdata by a p ri* 
Yat^kej^nd the fir st information processor resp onds 
jpjhe.ele ctrppjcjp^ 

^.PgyirjgnlJlgg^Qst.to transmit a repayment receipt o b- 
tained by digitally signing data including identification of 
Jhej-epayment permit data by a private key from the se c- 
ond information processor to the third information proc- 
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D s riptlon 

The pr sent invention relates to a shopping system 
for safely carrying out transactions by utilizing electronic 
money on a communication network. 

US patent No. 5,440,634 and Secure Electronic 
Transaction (SET) Specification; June 17, 1996 teach 
an electronic value transfer system and cashless trans- 
action, and digital signatures. 

Today, a system for doing shopping by using an 
open network such as an internet has come to the front. 
In existing systems, a retail shop offers goods informa- 
tion to a consumer through a world-wide web (WWW) 
server, and the consumer selects goods desired to be 
purchased by watching the goods information at a 
WWW browser and gives an order. Principally, a method 
of using a credit card and a method of using electronic 
money are employed for payment. 

In internet shopping, security matters. Since any- 
one can access the internet with ease, there is a possi- 
bility that information is eavesdropped and altered by a 
third person. Also, there is a possibility that a third per- 
son impersonate an authorized user to carry out trans- 
actions. Further, there is a possibility that a person con- 
cerned who participates in transactbns substitutes da- 
ta, denies the contents of transactions and runs away 
with the money. 

To cope with the problems as above, the existing 
system utilizes encryption of data, digital signatures and 
a certificate authority. For encryption of data, such meth- 
ods as data encryption standard (DES) and RSA are 
available. 

The digital signature is used as a technique for pre- 
venting substitution of data, specifying a planner of data 
and authenticating a communication partner. The digital 
signature is data encrypted by calculating a Hash value 
of the data to be signed and applying asymmetric key 
cryptography algorithm represented by RSAtotiie Hasb 
value. As algorithm for calculation of the Hash value, 
SHA-1 and MD5 are used. For verifying the validity of 
the digital signature, data decrypted by using the other 
encryption key paired with the encryption key used 
when the digital signature is prepared is compared with 
a Hash value of original data when the digital signature 
is prepared and it is checked whether one coincides with 
the other. Typically, the digital signature together with its 
original data is transferred to a communication partner. 

In a shopping system and an electronic money sys- 
tem conforming to the existing open network, encryption 
and digital signature are utilized to prevent eavesdrop- 
ping and alteration of data during communication. In the 
case of transaction protocol presupposing credit card 
payment in SET, only the processing of giving an order 
to a retail shop and th processing of obtaining approval 
of a card company are carried out through the open net- 
work but the processing for payment is carried out 
through a banking organ network. In this cas , an in- 
voice c rtifying the contents of transactions is mailed to 
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a card owner and completion of payment can be evi- 
denced by a withdrawal record from a ban k account. Ac- 
cordingly, in the SET, data cone ming invoice and re- 
ceipt is not handled. 
iff— When transactions are carried out by utilizing e\ec 
|j tronic money on the open network, all processings in- 
1 1 eluding the payment process are essentially executed 
Jj on the open network. Therefore, electronic data which 
1} can objectively certify the contents of transactions and 
1) the completion of payment must be presented during 
transactions through the communication network. It 
matters that the data is rewritten by a third person in the 
course of communication and the data is rewritten by a 
\ person concerned who receives the data or a recipient 
«l at his or her discretion. J 
Further, in a system in which an information proc- 
essorfor giving an order or a client, an information proc- 1 
essor for receiving or managing the order or an ordering 
management server and an information processor for 
receiving and managing the money or a payment server 
are connected to a communication network, when a 
third organ enjoying confidence is agential for execution 
of payment, ordering information and payment informa- 
tion must be transferred between the information proc- 
essors without being substituted and when any troubles 
are raised lateron, the contents of ordering and the com- 
pletion of payment must be confirmed by causing a per- 
son participating in the transactbns to offer the ordering 
informatbn and the payment information and it must be 
certified that the data is not substituted. 

Further, not only when goods is purchased but also 
J when goods are returned or transactions are canceled, 
I the money pg yst be repaid s afely to a purchaser by using 
/ electrons money through the communication network. 
351 In this case, unauthorized reception of a refund by athird 
I oerson must be prevented. 

An object of the present invention is to provide a 
system and a method which can provide a person par- 
ticipating in transactions with data for certifying the con- 
tents of transactions and the state of payment on a com- 
municatbn network when shopping is carried out on the 
communication network by using electronic money. 

Another object of the present invention is to provide 
a system and a method which can avoid any troubles in 
transactbns among an information processor for order- 
ing, an information processor for receiving and manag- 
ing an order and an information processor for receiving 
and managing the money which are connected to a net- 
work. 

.Still another object of the present invent on is to pro-^ 
/vide a system and a method which can repay a refund 
I to an authorized purchaser by preventing the refund 
I from being tapped by an unauthorized third person 
I wh n the money of returned goods or an amount of 
55) mon yexc ssively paid in advance is r paid to the pur 
I chas rbyusingelectronicmoneyonthecommunicatbn 
(^network. 

According to on aspect of th present invention, a 
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shopping system for communicating shopping data 
comprises: 

a first information processor adapted to transmit or- 
dering data in accordance with an order and having 
a first storage unit for storing an address to which 
the ordering data is to be transmitted and a second 
storage unit for storing electronic money; 
a second information processor connected to the 
first information processor through a network and 
being responsive to the ordering data to issue a 
payment address corresponding to the order and 
invoice data obtained by digitally signing an invoice, 
the first information processor being operative to re- 
spond to the invoice data to transmit an amount of 
electronic money corresponding to the order to the 
payment address; and 

a third information processor connected to the first 
and second information processors through the net- 
work and being responsive to reception of the 
amount of electronic money to issue a receipt dig- 
itally signed by a private key, the first information 
processor being operative to transmit to the second 
information processor the digitally signed receipt re- 
ceived from the third information processor. 

The first information processor can digitally sign the 
invoice data digitally signed by the second information 
processor to transmit it to the third information proces- 
sor, and the third information processor can check (ver- 
ify) two signatures on the received invoice data of which 
one is signed by the second information processor and 
the other is signed by the first information processor. 

The second information processor can check (ver- 
ify) whether the signature on the receipt received from 
the first information processor coincides with the pay- 
ment address affixed to the invoice data. 

The first information processor can transmit a re- 
quest for repaying the electronic money transmitted to 
the third information processor in accordance with the 
order to the second information processor, the second 
information processor can transmit repayment permit 
data including data for specifying a repaying apparatus, 
an amount of refund and data for specifying a refund 
receiving apparatus after digitally signing the repayment 
permit data by a private key, and the first information 
processor can respond to the electronic money remitted 
in accordance with the repayment request to transmit 
the repayment receipt digitally signed by the private key 
on data including identification of the payment permit 
data by means of the second information processor to 
the third information processor. 

The second information processor can use identifi- 
cation data included in certificate data digitally signed 
by a certificat authority, in order to sp cify the first in- 
formation proc ssor or the user thereof. 

According to another aspect of th present inven- 
tion, an information processor connected to a shopping 
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system for communicating shopping data comprises: 

a controller for transmitting ordering data in accord- 
ance with an order; 

a first storage unit for storing an address to which 
the order data is to be transmitted; and 
a second storage unit for storing electronic money, 
wherein the controller responds to a payment ad- 
dress issued in accordance with the ordering data 
and corresponding to the order and invoice data ob- 
tained by digitally signing an invoice to transmit an 
amount of electronic money corresponding to the 
order to the repayment address and transmits a 
copy of a receipt issued in accordance with the 
amount of electronic money and digitally sjg/jedjay^ 
a private_key- 



According to still another aspect of the present in- 
vention, an information processor connected to a shop- 
20 ping system for communicating shopping data compris- 



es: 
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a control unit responsive to received ordering data 
to issue a repayment address corresponding to the 
order and invoice data obtained by digitally signing 
- . an invoice; and 
a communication unit for receiving a receipt, 
wherein the control unit checks (verifies) whether a 
signature on the received receipt coincides with the 
payment address affixed to the invoice data. 



According to still another aspect of the present in- 
vention, an information processor connected to a shop- 
ping system for communicating shopping data compris- 
es es: 
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a control unit responsive to reception of an amount 
of electronic money corresponding to an order to 
issue a receipt digitally signed by a private key; and 
a communication unit for communicating invoice 
data and receipt data, 

wherein the control unit checks (verifies) the signa- 
ture on the received invoice data. 
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In the drawings 
Fig. 1 is a block diagram showing the overall con- 
struction of the present invention- 
Fig. 2 is a block diagram showing the construction 
of a client. 

50 Fig. 3 is a block diagram showing the construction 
of an ordering management server. 

Fig. 4 is a block diagram showing the construction 
of an electronic money payment server. 

Fig. 5 is a flow chart showing flow of m ssages, in- 
55 voice data and receipt data in the purchase process. 
Fig. 6 is a diagram showing a data structure of th 
invoice data. 

Fig. 7 is a diagram showing a data structure of the 
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receipt data. 

Fig. 8 is a flow chart showing the proc ss by the 
client in the purchase process. 

Fig. 9 is a flow chart showing the process by the 
ordering management server in the purchase process. 

Fig. 10 is a flow chart showing the process by the 
electronic money payment server in the purchase proc- 
ess. 

Fig. 11 is a diagram showing an ordering data struc- 
ture stored in a storage unit of the ordering management 
server. 

Fig. 12 is a diagram showing an ordering data struc- 
ture stored in a storage unit of the ordering management 
server. 

Fig. 1 3 is a diagram showing a payment data struc- 
ture stored in astorage unit of the electronic money pay- 
ment server. 

Fig. 14 is a diagram showing a client screen on 
which ordering data is displayed. 

Fig. 15 is a diagram showing a client screen on 
which invoice data is displayed. 

Fig. 16 is a diagram showing a client screen on 
which receipt data is displayed. 

Fig. 17 is a flow chart showing messages, repay- 
ment permit data and repayment receipt data in the re- 
payment process. 

Fig. 18 is a diagram showing a data structure of the 
repayment permit data. 

Fig. 1 9 is a diagram showing a data structure of the 
repayment receipt data. 

Fig. 20 is a flow chart showing the process by the 
client in the repayment process. 

Fig. 21 is a flow chart showing the process by the 
ordering management server in the repayment process. 

Fig. 22 is a flow chart showing the process by the 
ordering management server in the repayment process. 

Fig. 23 is a flow chart showing the process by the 
electronic money payment server in the repayment 
process. 

Fig. 24 is a diagram showing a client screen on 
which repayment request data is displayed. 

Fig. 25 is a diagram showing a client screen on 
which the repayment permit data is displayed. 

An embodiment of an on-line shopping system ac- 
cording to the present invention will be described here- 
under with reference to the accompanying drawings. 

Fig. 1 shows, in block diagram form, the overall con- 
struction of the system of the present invention which is 
connected to a computer network 4 an d a certificate au- 
thority 8. An information processor 1 gives an order for 
goods and service and is called a clien t, an information 
processor 2 accepts and manages the order and is 
caj led an ordering managementserver, and an informa- 
tion processor 3 accepts and manages the money and 
is called an el ectronic moj ie^aymjTt server. The com- 
puter network 4 interconnects the information proces- 
sors 1 to 3 and is typically ex mplified by an internet. 

The client 1 is construct d as shown, in block dia- 
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gram form, in Fig. 2, An lectronic money storage unit 
1 1 stores electronic money and may be r alized with i- 
ther an IC memory, such as an IC card (also called a 
smart card) or an IC memory with hardware logic, or an- 
5 other external memory device such as a harddisc. A 
communication unit 12 communicates with another in- 
formation processor and is used to transmit and receive 
electronic money, ordering data, invoice data and re- 
ceipt data. A storage unit 1 3 stores programs and vari- 
10 ous kinds of data as well as a private key for affixing a 
digital signature. A display unit 1 4 displays the ordering 
data, the invoice data and receipt data. An input unit 15 
inputs, for example, the ordering data. A control unit 16 
is for controlling programs running in the information 
15 processor land is adapted to prepare and verify digital 
signatures and control input and output, communicatbn 
and the execution sequence explained later. 

The ordering management server 2 is constructed 
as shown, in block diagram form, in Fig. 3. A storag e 
20 uni t21 stores programs, order data and customer da ta 
as well as aorivate key usedjor affixing a digital sign a- 
ture. A communication unit 22 communicates with a n- 
other inform ation processor and is adapted to trans mit 
ana receive ordering data, invoice data a nd receipt da ta. 
25 An input unit 23 inputs various kinds of data, and a dis- 
p lay unit 24 displays various kinds of data. The input unit 
23 and the display unit 24 may be omitted. A control unit 
25 controls programs running inthe management serv er 

30 and control jnput and output, communication and the ex- 
e^utipn^seg uenc e. 

The electronic money payment server 3 is con- 
structed as shown, in block diagram form, in Fig. 4. An 
electronic money storage unit 3 1 stores electronic mon- 
35 ey"a ffaifke~the^16ctronic moneystora g e unit 11, it is 
r ^g!! z ^lM!l^' tner - a ili£^ ^ or anothere xtemal'Stor- 
age unit. A communication unit 32 communicates with 
another information processor and is adapted to trans- 
mit and receive electronic money, invoice data and re- 
40 ceipt data. A storage unit 33 stores programs and vari- 
ous kinds of data as well as a private key for affixing a 
digital signature. An input unit 35 inputs various kinds 
of data and a display unit 34 displays various kinds of 
data. The display unit 34 and the input unit 35 may be 
45 omitted. The control unit 36 controls programs running 
in the payment server 3. 

The embodiment of the present invention will now 
be described by way of two examples of purchasing 
goods or service (a purchase process) or repaying 
so goods or service (a repayment process) in the on-line 
shopping system of the present invention. 

(a) Purchase of goods or service (purchase process) 

55 Fig. 5 is a flow chart showing flow of messages, in- 
voic data 51 and rec ipt data 53 in the purchas proc- 
ess. Messages 1 10 to 220 are each transmitted and re- 
c iv d between the information proc ssors. The invoice 
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data 51 is described with n M" which indicates that the 
invoice data 51 is digitally signed by t he ordering man- 
agement server 2. A money r ceipt requesrmessage 
f5> is described with a digital signature 52 affixed by 
the client 1. The receipt data 53 is described with n P B 5 
which indicates that the receipt data 53 is digitally signed 
by the electronic money payment server 3. The digital 
signature 'C designated by reference numeral 52 and 
described on different invoice data 51 indicates that the 
invoice data 51 is digitally signed by the client 1 . 10 

Fig. 6 shows a data structure of the invoice data 51 
and Fig. 7 shows a data structure of the receipt data 53. 
Data items illustrated in the figures are mere examples 
and other data items may be used. The digital signature 
is obtained by calculating a Hash value of data to be 15 
signed and encrypting the Hash value by a private key. 
The Hash function used for calculating the Hash value 
is represented by algorithm such as SHA-1 and MDS. 
An asymmetric key cryptography algorithm such as 
RSA (elliptic curve cryptography) is used for the method 20 
for encryption by the private key. For verification of the 
digital signat ure, it is checked whether data obtained b y 
aecoamg tne aigrtai signature by^public^cey^jairMwitb 
tho_ private Key coincideTwith data obtained by calc u- 
lati ng a Hash value of pl aintext data to be signed. A dig- 2s 
J tal si gjTatu^5 51sTibtaihed by encrypting a Hash valu e 
of data block 54 b y a private ke y owned by the ordering 
management serverg . Ad igital signature 581sobteJn ed 
b^ encryptin g a Hash value of data block 57 by a private 
key owned Bylhe electronic money payment serye i3. 3d 

The processing procedure by the client 1 is shown 
in a flow chart of Fig. 8, the processing procedure by the 
ordering management server 2 is shown in a flow chart 
of Fig. 9 and the processing procedure by the electronic 
money payment server 3 is shown in a flow chart of Fig. 35 
10. 

Ordering data pieces 61 and 62 stored in the stor- 
age unit 21 of the ordering management server 2 are 
shown in Figs. 1 1 and 12. Payment data 63 stored in the 
storage unit 33 of the electronic money payment server 40 
3 is shown in Fig. 13. 

Referring now to Figs. 5, 8, 9 and 10, the processing 
procedure of the purchase process will be described. 

In the following description, the term "authentica- 
tion" means certifying jhat a recipient in no w communi- 45 
cation coincides with a recipient with whom an originator 
is aD^rtb^commUnlc^ 

^tfientiflcatroTJ" means dalawhlchincludes a pu5Iic~Rey 
and an identif ier ofl he owner of the public Key and'wfT ich 
is d ' 9 jj^j[g^ pne^I&yJLb e cer tificate authori ty. so 

A user designates, on the display screen of the cli- 
ent 1 , goods/service and the number thereof from goods 
information sent from the server 2 to the client 1 and 
d signates ordering data from the electronic money and 
cr dit (the bank account may further b added), and the 55 
designated goods/servic , the number thereof and the 
ordering data are inputted to the client 1 . 

/ Wher^tl^ordering data is inputted to th client 1 



(st p 310), the client makes a request (st p 320) to the 
ordering management server for a message 110 having 
a certificate for authentification (including a public key) 
of the ordering management serv r. When receiving the 
message 110 (step 510), the ordering management 
server prepares a response message 120 including the 
certificate for authentification (inclusive of the public 
key) of the ordering management server, digitally signs 
the whole of the message and sends the message 120 
to the client (step 520). A certificate of the payment serv- 
er the management server has obtained from the certif- 
icate authority is enclosed in an invoice and sent in the 
form of a message 1 40. 

In step 320, the client 1 takes the public key of the 
ordering management server from the sent certificate 
and verifies the validity of the digital signature on the 
message 1 20. If valid, an identifier indicative of the own- 
er of the public key included in the sent certificate is dis- 
played, thereby allowing a consumer to select the coin- 
cidence or non-coincidence with a partner with whom 
the consumer transacts. If coincidence is selected, the 
authentification of the ordering management server is 
proven to be successful and the program proceeds to 
the next step. If non-coincidence is selected, the 
processing ends. 

^ Then, the client 1 transmits ordering data in the fonmT^S 
of a message 130 to the ordering management server J 
(step 330). The client now digitally signs the ordering / 
request message including the ordering data. A jsertifi- / 
cate of the client is also transmitted alona jwi th the_^o r- 
d erin g data through the medium of this message . 
An example of an ordering data screen displayed 
l-"6n the display unit of the client 1 is shown in Fig. 14. 
When the ordering management server 2 receives the 
message 130 (step 530), the ordering data is stored in 
the storage unit21 (step 540) and invoice data51 is pre- 
pared (step 550). An identifier for identification of the 
client is inserted in the invoice data 51. The identifier is 
identical to payer ID in Fig. 6. An identifier of the owner 
of the public key included in the certificate of the client 
is used as the payer ID. In place of the aforementioned 
identifier, the public key included in the certificate may 
be used. The ordering management server digitally 
signs the invoice data. 

The management server 2 transmits to the client 1 
the message 1 40, that is, a payment request message 
including the invoice data affixed with signature (step 
560). 

An invoice data screen 72 displayed on the display 
unit of the client 1 is shown in Fig. 1 5. When the payment 
request message 140 is received, the screen 72 may 
preferably be displayed. 

When receiving the message 140 (step 340), the 
c!i nt 1 verifies the validity of the digital signature on the 
invoice. Th invoice is displayed in compliance with the 
requirement by the consumer (the owner of the client). 
For example, when the price is low, no display is effect- 
ed. If the digital signatur is valid, the program proceeds 
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to the next step but if invalid, an error is display d, stop- 
ping the processing (A). 

Th client t transmits a money reception requ st 
message 150 including the invoice data 51 and affixed 
with the digital signature 52 of the client to the payment 
server (step 350). At that time, the certificate for authen- 
tification of the client is concurrently sent. The payment 
server receiving the message 150 in step 710 verifies 
the validity of the digital signatures on the aforemen- 
tioned message affixed by the ordering management 
server and affixed by the client. What is meant by veri- 
fication of the validity of the digital signature by the or- 
dering management server is to verify whether the dig- 
ital signature of the ordering management server is af- 
fixed in order to check if the transmission contents is 
acceptable to the payment server. For example, when 
public keys of acceptable ordering management servers 
are stored in storage units of a plurality of ordering man- 
agement servers, respectively, and the digital signature 
is verified by any one of the public keys, it can be decid- 
ed whether the invoice sent from the client is transmitted 
from an ordering management server which is accept- 
able to the payment server. On the other hand, for ver- 
ification of the signature of the client, it is first checked 
whether the payer ID included in the invoice coincides 
with the identifier of the owner of the public key^included 
in the sent certificate of the client. If coincident, the va- 
lidity of the client digital signature on the message 150 
is verified by the public key included in the certificate. If 
the digital signature is valid, it can be confirmed that the 
partner to which the ordering management server has 
issued the invoice is identical with the transmitter of the 
message 150. 

If the digital signatures of the ordering management 
server and the client are valid, a money reception re- 
sponse message including data indicative of payment 
permission is prepared. The payment server digitally 
signs the message. 

The payment server 6ends the money reception 
message 160 to the client (step 740). 

The client verifies whether the digital signature of 
the received message 160 (step 360) has been signed 
by the payment server which is about to pay the money. 
Since the client has received the public key of the pay- 
ment server from the ordering management server 
through the medium of the message 140, it verifies the 
validity of the digital signature by the public key. If the 
digital signature is valid, it is certified that the message 
160 is from the payment server designated by the or- 
dering management server, indicating that the authen- 
tification of the payment server is successful. If the au- 
thentication succeeds (step 370), the program pro- 
ceeds to the next step. But if unsuccessful, a failure of 
th authentication is displayed and the processing 
ends (A). 

The client sends electronic money data 170 to the 
payments rver (step 380). 

When one or mor going and returning is needed 



between the client and the payment serv r for the sake 
of sending th electronic money, the payment server 3 
sends electronic money data to the client through the 
medium of a message 180. The messages 170 and 180 

5 are transmitted by a frequency which is necessary for 
transmission of the electronic money data. When a final 
electronic money reception notice is sent through the 
medium of the message 180, a receipt may be sent to 
thereby omit messages 190 and 200. When the final 

io electronic money data is sent through the medium of the 
message 170 (that is, the message from the client to the 
server), only a receipt is sent through the medium of the 
message 1 80. The payment server digitally signs the re- 
ceipt. 

*5 The client receiving the receipt in step 41 0 verifies 
the validity of the digital signature on the receipt by the 
public key of the payment server. If valid, the program 
proceeds to the next step but if invalid, an error is dis- 
played to end the processing. Thereafter, the client 

20 transmits a copy of the receipt in the form of a message 
210 to the ordering management server, thus informing 
the server that the payment is finished (step 420). 

A receipt data screen 73 to be displayed on the dis- 
play unit of the client 1 is shown in Fig. 16. When the 

25 receipt response message 200 is received, the screen 
73 may preferably be displayed. 

The ordering management server verifies the valid- 
ity of the digital signature on the receipt by the public 
key of the payment server (step 580). The public key 

30 used at that time is the public key included in the certif- 
icate which is included in the invoice when the invoice 
is prepared. Through this, it can be confirmed whether 
the payment is made to the payment server the ordering 
management server has designated. 

35 |f the result of the foregoing processing is valid, the 
ordering management server 2 transmits to the client a 
message 1 90 including data indicative of the completion 
of transaction but if invalid, it transmits to the client an 
error message 220 indicating that the receipt is not au- 

40 thorized (step 670). 

When the client 1 receives the ordering response 
message 220 from the ordering management server 2 
(step 430), the purchase process ends. 

Through the above processing, safe transactions 

45 can be effected when the client 1 , the ordering manage- 
ment server 2 and the electronic money payment server 
3 are each connected to the computer network 4. The 
invoice data 51 and receipt data 53 can be used as ev- 
idences proving the contents of transactions and the 

50 payment completion state in the event that any troubles 
in transactions are raised later on. Further, by the afore- 
mentioned step 720, any unauthorized access to the 
electronic money payment server 3 can be prevented. 
In th for going embodiment, the digital signature 

55 affixed by th ordering management server on the mes- 
sage 120 can be omitted. In this case, the process in 
whichthecli ntauth nticates the ordering managem nt 
serv rcanbeunne ded. 
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The digital signature affix d by the cli nt on the 
message 130 can be omitted. In this case, the payer ID 
of the invoic can be unneeded and the process of th 
digital signature of the client can be unneeded in the 
payment server. 

(b) Repayment (repayment process) 

Flow of messages, repayment permit data (also 
called repayment permission data) 81 and repayment 
receipt B3 is shown in a flow chart of Fig. 1 7. Messages 
1110 to 1220 are each transmitted and received be- 
tween the information processors. The repayment per- 
mit data 81 is described with °M B which indicates that 
the repayment permit data 81 is digitally signed by the 
ordering management server 2. A refund remittance re- 
quest message 1 1 50 is described with a digital signature 
82 affixed by the client 1 . The repayment receipt 83 is 
described with "C" which indicates that the repayment 
receipt 83 is digitally signed by the client 1 . 

Fig. 1 8 shows a data structure of the repayment per- 
mit data 81 and Fig. 19 shows a data structure of the 
repayment receipt 83. Data items illustrated in the fig- 
ures are mere examples and other data items may be 
used. A digital signature 85 is bbtained by encrypting a 
Hash value of data block 84 by a private key owned by 
the ordering management server 2. A digital signature 
88 is obtained by encrypting a Hash value of data block 
87 by a private key owned by the client 1 . 

The processing procedure by the client 1 is shown 
in a flow chart of Fig. 20, the processing procedure by 
the ordering management server 2 is shown in flow 
charts of Figs. 21 and 22 and the processing procedure 
by the electronic money payment server 3 is shown in 
a flow chart of Fig. 23. 

Referring now to Figs. 17, 20, 21, 22 and 23, the 
processing procedure of the repayment process will be 
described. 

When data necessary to make a repayment in the 
client 1 is inputted using the input unit 15 (step 1310), a 
repayment request message 1110 to be described be- 
low is transmitted to the ordering management server 2 
(step 1320). Fig. 24 shows a screen 91 for repayment 
request which is displayed on the display unit 14 of the 
client 1. 

When the client digitally signs an ordering request 
message during purchase, the client also digitally signs 
the repayment request message 1110 . This process is 
necessary to certify that the purchaser coincides with 
the repayment requester. In order for the management 
server (step 1 51 0) to verify the validity of the digital sig- 
nature on the message 1110 (step 1520), the manage- 
ment server uses the same public key as that of the di- 
nt used during purchas . This permits authentication 
\^of an authorized repayer. 

r*. When the client has not signed an ordering request 
message during purchas , the client need not digitally 
sign th m ssage 1110 because the identity of the pur- 



chaser to th r payment request r cannot b v rifiedby 
the digital signature. In this case, the validity of the r - 
payment requester can be v rified by the transmission 
of a rec ipt during purchase through the m dium of the 
5 messag 1110. 

When the ordering management server 2 receives 
the aforementioned message 1110 (step 1510), it is 
checked whether transaction ID designated by the mes- 
sage is repayable. If repayable, the ordering data 61 in 

10 the storage unit 21 is updated to "during repayment' 
(step 1550), the repayment permit data 81 is prepared 
(step 1560) and a repayment response message 1140 
including the repayment permit data 81 is transmitted to 
the client 1 (step 1570). 

75 Like the message 1 40 in the purchase process, the 
message 1140 is digitally signed by the ordering man- 
agement server. 

Fig. 25 shows a screen 92 of the repayment permit 
data displayed on the display unit 14 of the client 1 . The 

20 screen 92 may be displayed when the repayment re- 
sponse message 1140 is received. 

When the client 1 receives the response message 
1140 (step 1330), a refund remittance request message 
1150 including the repayment permit data 81 included 

25 in the response message 1 140 is affixed with the digital 
signature 82 encrypted by the private key owned by the 
client 1 and is transmitted to the electronic money pay- 
ment server 3 (step 1340). 

However, when no digital signature is affixed on the 

30 message 1110, the digital signature can be omitted be- 
cause the validity of the digital signature cannot be ver- 
ified. 

When the electronic money payment server 3 re- 
ceives the request message 1150 (step 1740), it is 
35 checked by using the repayment permit data 81 and the 
digital signature 82 whether the transaction is repayable 
(step 1750). 

- When the digital signature of the client is verified, it 
is checked that an owner identifier of the public key in- 
cluded in the certificate which is transmitted together 
with the present message by the client coincides with 
repayment recipient ID included in the payment permit. 
If coincident, the validity of the digital signature which is 
affixed to the present message by the client by means 
of the public key included in the certificate is verified. If 
vajicj4st ej^1760), authentificatbn of the client is I si 
cessf ul. In other words, it is certified that the perso n re ~ 
eiving repayment permission coincides with the perso n 
kaqsmjttin g the present message . 

Even when the digital signature is not used in the 
message 1110, a digital signature may be affixed if the 
payment server desires to leave a record as to to whom 
the repayment is made, for the purpose of specifying an 
unauthorized repayment requester. 
55 Mor specifically, in a checking method in this case, 
it is first checked by using the public key of the ordering 
management s rver whether the afor mention d re- 
paym nt permit data 81 is digitally signed by the ord r- 
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ing management s rver 2. Th e payment s rver ma y 
store, in advance, the public key of the managemen t 
"Server in th storage unit 33 or may transmit the cerc if- 
icate or the ordering management server together with 
the payment certificate data 8.1 . The c rtificate include s 
data for identif ying the order managemenLservBJLaod 
me^uTJfickey Further, the certificate is digitally signed 
TSy ifteTeTOficate authority. When the client has digitally 
signed data including the payment permit data 81 trans- 
mitted from the client, it is checked whetherthe payment 
recipient coincides with the person who has affixed the 

digital Signature 82. In this ^sa, Hatffl for identifying, the 

r epayment recipient is included in the repayment perm it 
data 81 and aslft is Icten tif vin n data and so dataiodden- 
tifying the owner of the public kev included in the certif - 
i cate may be used. Fi rstly, it is checked whetherthe data 
for identifying the owner of the public key included in the 
certificate transmitted together with the digitally signed 
repayment permit data 81 coincides with the data for 
identifying the payment recipient included in the repay- 
ment permit data 81 . Further, by verifying the validity of 
the digital signature by the public key included in the 
certrfjg ale, it is decided whether an authorized repay- 
ment recipient makes a request to the payment server 
for repayment. In an alternative, when communication 
data is encrypted (in other words, when the communi- 
cation path is encrypted), the payment permit data 81 
will not be usurped and therefore, the step for the client 
to sign the repayment permit data 81 and the step for 
the payment servertoverify thevalidity ofthe repayment 
recipient can be omitted. When the result of the step 
1750 is valid (step 1760), a refund remittance response 
message 1 1 60 including data indicative of payment per- 
mission is transmitted to the client 1 (step 1770). 

The necessity for affixture of the digital signature of 
the payment server to the message 1160 is small be- 
cause the client receives the money and so the neces- 
sity for authentication of the payment server in this 
case is smaller than in the case where the money is sent 
to the payment server. 

When the result of step 1750 is invalid (step 1760), 
a refund remittance response message 1160 including 
data indicative of impermissible repayment is transmit- 
ted to the client 1 (step 1850). When the client 1 receives 
the response message 1160 (step 1350) and the mes- 
sage 1160 includes the data indicative of impermissible 
repayment (step 1360), a message 1170 indicative of 
electronic money remittance request is transmitted to 
the electronic money payment server 3 (step 1370). 
When in step 1 360 the message 11 60 includes the data 
indicative of impermissible repayment, the processing 
ends. 

When receiving the message 1170 (step 1780), the 
electronic money payment s rv r 3 remits electronic 
mon y 1180 to the client 1 (step 1790). The transmis- 
sion of th messages 1170 and 1180 may be effect d 
plural times. When receiving the electronic money 11 B0 
(step 1380), the client 1 prepares repayment receipt da- 



ta 83 (step 1390) and transmits a repaym nt receipt 
transmission m ssage 1190 including the receipt data 
83 and digitally signed by the client to th electronic 
money payment server 3 (step 1400). 
s In the case of the authorized requester, this is necessary 
for certifying that the repayment is completed and in the 
case of the unauthorized requester, this is necessary for 
specifying the criminal later on. 

When the electronic money payment server 3 re- 
10 ceives the message 1 1 90 (step 1 800), the payment data 
63 stored in the storage unit 33 is updated to "repayment 
completion 11 (step 1810) and a repayment receipt re- 
sponse message 1 200 is transmitted to the client 1 (step 
1820). When the client 1 receives the response mes- 
1$ sage 1200 {step 1410), the processing ends. 

The ordering management server 2 transmits a re- 
payment completion inquiry message 1210 to the elec- 
tronic money payment server 3 (step 1610). When re- 
ceiving the inquiry message 1210 (step 1830), the elec- 
tronic money payment server 3 transmits a repayment 
state response message 1220 including the repayment 
completion state to the ordering management server 2 
(step 1840). If the repayment has already been finished 
at that time, a completion response is transmitted. The 
repayment receipt 83 received from the client 1 may be 
transmitted through the medium oHhe response mes- 
sage 1220. When the ordering management server 2 
receives the response message 1220 (step 1620), the 
ordering data 61 stored in the storage unit 21 is updated 
to "repayment completion 11 (step 1630) and the process- 
ing ends. Instead of the fact that the ordering manage- 
ment server inquires the payment server about the re- 
payment completion state, the payment server may in- 
forms the ordering management server of the repay- 
ment completion when it receives the repayment receipt 
from the client. 

Through the above processing, the repayment can 
be made safely by using the electronic money when the 
client 1 , the ordering management server 2 and the elec- 
tronic money payment server 3 are each connected to 
the computer network 4. The repayment permit data 81 
and repayment receipt data 83 can be used as evidenc- 
es proving the contents of repayment and the repay- 
ment completion state in the event that any troubles in 
the repayment are raised later on. Further, by the step 
1750, any unauthorized access to the electronic money 
payment server 3 can be prevented and unauthorized 
receipt ofthe refund by other persons can be prevented. 

Programs for execution of the processing shown in 
Fig. 8 or 20 may be stored in a portable memory medium 
such as a floppy disc and the medium may be written to 
the storage unit 13 of the client 1 to execute the process- 
ing. The same holds true for the ordering management 
server 2 and the lectronic money payment server 3. 

Inth foregoing mbodiments, some alterations are 
possible. For example, the m ssage 110 may be trans- 
mitted to the c rtificate authority to obtain a certificate, 
the digital signature of the client on the message 1110 
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may be omitted, the paired m ssages 1120 and 1130 
may b omitted, the digital signature of the client on the 
message 1 1 50 may be omitted, and the messages 1 21 0 
and 1220 may be omitted because confirmation by a dif- 
ferent means, for example, confirmation by mail may be 5 
employed. When the payment server receives the re- 
payment receipt from the client without using the mes- 
sage 1210, the message 1220 may be transmitted. 

10 

Claims 

1. A shopping system having a plurality of information 
processors to communicate shopping data among 
them, comprising: is 

a first information processor (1) adapted to 
transmit ordering data in accordance with an or- 
der and having a first storage unit (1 3) for stor- 
ing an address to which the ordering data is to 20 
be transmitted and a second storage unit (11) 
for storing electronic money; 
a second information processor (2) connected 
to said first information processor (1 ) through a 
network (4) and being responsive to said order- 2s 
ing data to issue a payment address corre-^ 
sponding to the order and invoice data (51 ) ob- 
tained by digitally signing an invoice, said first 
information processor being operative to re- 
spond to said invoice data to transmit an 30 
amount of electronic money corresponding to 
said order to said payment address; and 
a third information processor (3) connected to 
said first and second information processors 
through said network and being responsive to 35 
reception of said amount of electronic money 
to issue a receipt (53) digitally signed by a pri- 
vate key, said first information processor being 
operative to transmit to said second information 
processor said digitally signed receipt received 40 
from said third information processor. 

2. A shopping system according to claim 1, wherein 
said first information processor digitally signs said 
invoice data digitally signed by said second infor- 45 
mation processor to transmit it to said third informa- 
tion processor, and said third information processor 
checks twosignatures on said received invoice data 

of which one is affixed by said second information 
processor and the other is affixed by said first infor- &> 
.mation processor. 

3. Ashoppingsystemaccordingtoclaim 1 or2, where- 
in said second information processor checks 
whether the signature on said rec iptreceiv dfrom & 
said first information processor coincides with said 
payment address affixed to said invoice data. 



4. A shopping system according to claim 1 , 2 or 3, 
wherein said first information processor transmits a 
request for repaying the electronic money transmit- 
ted to said third information processor in accord- 
ance with th order to said second information proc- 
essor, said second information processor transmits 
repayment permit data including data for specifying 
a repaying apparatus, an amount of refund and data 
for specifying a refund receiving apparatus after 
digitally signing the repayment permit data by a pri- 
vate key, and said first information processor re- 
sponds to the electronic money remitted in accord- 
ance with said repayment request to transmit to said 
third information processor the repayment receipt 
digitally signed on data including identification of 
said repayment permit data by the private key. 

5. A shopping system according to claim 4, wherein 
said second information processor uses identifica- 
tion data included in certificate data digitally signed 
by a certificate authority, in order to specify said first 
information processor or a user thereof. 

6. A shopping system according to claim 4, wherein 
said second information processor uses the private 
key used for specifying said first information proc- 
essor during ordering, in order to specify said first 
information processor or a user thereof. 

7. A shopping system according to claim 4, wherein 
said first information processor digitally signs said 
repayment request transmitted to said second infor- 
mation processor, apparatus. 

8. A shapping system according to claim 4, wherein 
said first information processor digitally signs and 
sends said repayment permit data digitally signed 
by said second information processor to said third 
information processor, and wherein said third infor- 
mation processor checks whether a receiver noted 
in said repayment permit data coincides with a 
sender of said repayment permit data to said third 
information processor. 

9. A shopping system according to claim 8, wherein 
said third information processor uses identification 
data included in certificate data regarding said first 
information processor or a user thereof to identify 
said receiver noted in said repayment permit data. 

10. An information processor connected to a shopping 
system for communicating shopping data, compris- 
ing: 

a controller (15, 16) for transmitting ordering 
data in accordanc with an ord r; 
a first storage unit (13) for storing an address 
to which the ord ring data is to be transmitted; 
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and 

a second storage unit (1 1 ) for storing el ctronic 
money, 

wher in said controller responds to a payment 
address issued in accordance with said order- 5 
ing data and corresponding to said order and 
invoice data (51) obtained by digitally signing 
an invoice to transmit an amount of electronic 
money corresponding to said order to said pay- 
ment address and transmits a copy of a receipt 10 
(51 ) issued in accordance with said amount of 
electronic money and digitally signed by a pri- 
vate key. 

An information processing apparatus according to is 
claim 10, wherein a request for repaying the elec- 
tronic money transmitted corresponding to the or- 
der is transmitted, and a repayment receipt ob- 
tained by digitally signing repayment permit data by 
a private key is transmitted in accordance with the 20 
electronic money remitted in accordance with said 
repayment request. 

An information processor connected to a shopping 
system for communicating shopping data, compris- 25 
ing: 

a control unit (25) responsive to received order- 
ing data to issue a payment address corre- 
sponding to the order and invoice data (51 ) ob- 30 
tained by digitally signing an invoice; and 
a communication unit (22) for receiving a re- 
ceipt, 

wherein said control unit checks whether a sig- 
nature on the received receipt coincides with 3$ 
the payment address affixed to said invoice da- 
ta. 

An information processor according to claim 12, 
wherein said control unit digitally signs repayment 40 
permit data including data for specifying a repaying 
apparatus, an amount of refund and a refund receiv- 
ing apparatus by a private key and transmits said 
repayment permit data. 

45 

An information processor connected to a shopping 
system for communicating shopping data, compris- 
ing: 

a control un it (36) responsive to reception of an so 
amount of electronic money corresponding to 
an order to issue a receipt (53) digitally signed 
by a private key; and 

a communication unit (32) for communicating 
invoice data and receipt data, ss 
wherein said control unit checks the signature 
on th received invoice data. 



15. A method of communicating shopping data among 
a plurality of information processors in a shopping 
system having the plurality of information proces- 
sors, comprising the steps of: 

transmitting ordering data from a first informa- 
tion processor (1); 

responding to said ordering data to issue a pay- 
ment address corresponding to the order and 
invoice data (51) obtained by digitally signing 
an invoice from a second information processor 

(2); 

responding to said invoice data to transmit an 
amount of electronic money corresponding to 
said order from said first information processor 
to said payment address; 
responding to reception of said amount of elec- 
tronic money to issue a receipt (53) digitally 
signing by a private key from a third information 
processor (3); and 

transmitting said digitally signed receipt re- 
ceived from said third information processor 
from said first information processor to said 
second information processor. 

16. A shopping method according to claim 1 5, wherein 
said first information processor digitally signs said 
invoice data digitally signed by said second infor- 
mation processor to transmit it to said third informa- 
tion processor, and said third information processor 
checks two signatures on said received invoice data 
of which one is affixed by said second information 
processor and the other is affixed by said first infor- 
mation processor. 

17. A shopping method according to claim 15 or 16, 
wherein said second information processor checks 
whether the signature on said receipt received from 
said first information processor coincides with said 
payment address affixed to said invoice data. 

18. A shopping method according to claim 15 or 16, 
wherein said first information processor transmits 
to said second information processor a request for 
repaying the electronic money transmitted to said 
third information processor in accordance with the 
order, said second information processor transmits 
repayment permit data including data for specifying 
a repaying apparatus, an amount of refund and data 
for specifying a refund receiving apparatus after 
digitally signing the repayment permit data by a pri- 
vate key, and said first information processor re- 
sponds to the electronic money remitted in accord- 
anc with said r payment r quest to transmit a r - 
payment receipt obtained by digitally signing data 
including identification of said r payment permit da- 
ta by a private k y from said second information 
processor to said third information processor. 
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19. A shopping method according to claim 18, wherein 
said second information processor uses identifica- 
tion data included in certificate data digitally signed 
by a certificate authority, in order to specify said first 
information processor or a user thereof. 5 
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FIG. 8 
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FIG. 9 
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STATE 


210192 


8790392 


1230001 


2,500 


PAID 


210193 


3090890 


1230001 


4,000 
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210194 
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FIG. 14 
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ORDER SHEET 



ARTICLE NAME 


UNIT PRICE 


NUMBER 


ARTICLE A 


1,000 


1 


ARTICLE C 


1,500 


2 



TOTAL 4,000 
OK | I CANCEL 



FIG. 15 
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TRANSACTION ID 


210193 


PURCHASER ID 


3789817 


ORDERING 
CONTENTS 


ARTICLE A 


1 


ARTICLE C 


2 


PAYMENT AMOUNT 


4,000 YEN 


PAYMENT MODE 


ELECTRONIC MONEY 


RETAIL SHOP NAME 


TOKYO ON-LINE 
MAIL ORDER DEALER 


PAYMENT CUSTOMER 


ABC MONEY 
COLLECTION SERVICE 


PAYMENT ADDRESS 


http : //www.abc.com 


BILL DATE/HOUR 


1996.12.8 14 : 20 


PAYMENT DUE DATE 


1996.12.10 17 : 00 



| OK 



CANCEL 
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FIG. 16 



RECEIPT 



TRANSACTION ID 


210193 


PURCHASER ID 


3789817 


RECEPTION AMOUNT 


4,000 YEN 


RECEPTION MODE 


ELECTRONIC MONEY 


RETAIL SHOP NAME 


TOKYO ON-LINE 
MAIL ORDER DEALER 


RECIPIENT NAME 


ABC MONEY 
COLLECTION SERVICE 


RECEPTION 
DATE/HOUR 


1996.12.8 14 : 20 



OK 



CANCEL 
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FIG. 17 



CLIENT 1 
C 



ORDERING 
MANAGEMENT SERVER 2 
M 



ELECTRONIC MONEY 
PAYMENT SERVER 3 

P 
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REFUND REMITTANCE 
RESPONSE 



ELECTRONIC MONEY 
REMITTANCE 



REPAYMENT RECEIPT 
RESPONSE 



REFUND REMITTANCE 
REQUEST 
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REPAYMENT STATE 
REQUEST 
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REPAYMENT RECEIPT |C 
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FIG. 20 




TRANSMIT REMITTANCE 
REQUEST TO PAYMENT 
SERVER 3(1150) 
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1370 



TRANSMIT ELECTRONIC 
MONEY REPAYMENT 
REQUEST TO 
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FI6. 21 



c 



START 



3 



1510 



N IS PAYMENT 

REQUEST RECEIVED 
? (1110) 



CHECK IF TRANSACTION 
IS REPAYABLE 



UPDATE ORDERING 
DATA 61 TO "DURING 
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REPAYMENT 
PERMIT TO CLIENT 1 
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END 
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FIG. 23 



N 



1750 
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FIG. 24 



REPAYMENT REQUEST 
TRANSACTION ID : 210193 



ARTICLE NAME 


UNIT PRICE 


NUMBER 


ARTICLE A 


1,000 


1 


ARTICLE C 


1,500 


2 



REFUND TOTAL 4,000 
| OK 



CANCEL 



FIG. 25 
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REPAYMENT PERMIT 



TRANSACTION ID 


210193 


REPAYMENT 
RECIPIENT ID 


3789817 


REPAYMENT 
AMOUNT 


4,000 YEN 


REPAYMENT MODE 


ELECTRONIC MONEY 


RETAIL SHOP NAME 


TOKYO ON-LINE 
MAIL ORDER DEALER 


REPAYER NAME 


ABC MONEY 
COLCECTION SERVICE 


REPAYER ADDRESS 


http '. //www.abc.com 


REPAYMENT PERMISSION 
DATE/HOUR 


1996.12.12 18 : 10 


PEPAYMENT DUE DATE 


1996.12.15 18 : 10 



OK 



CANCEL 
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